Acrobat Reader plugin vulnerable to attacks

Security researchers studying over a weakness in the browser plugin for Adobe's Reader program

Security researchers are poring over what one vendor has called a "breathtaking" weakness in the Web browser plugin for Adobe Systems Inc.'s Acrobat Reader program, used to open the popular ".pdf" file format.

The problem was first highlighted by Stefano Di Paola and Giorgio Fedon, researchers who presented a paper in Berlin last week on security issues related to Web 2.0 technologies such as AJAX (Asynchronous JavaScript and extensible markup language).

The Acrobat weakness involves a feature called "open parameters" in the Web browser plugin for Adobe's Reader program.

The plugin allows arbitrary JavaScript code to run on the client side. The code could include a malicious attack on a computer, wrote Hon Lau on Symantec's Security Response Weblog on Wednesday.

"The ease in which this weakness can be exploited is breathtaking," Lau wrote. "What this means in a nutshell is that anybody hosting a .pdf, including well-trusted brands and names on the Web, could have their trust abused and become unwilling partners in crime."

Any Web site hosting a .pdf file could be manipulated to run an exploit, Lau wrote. Because an exploit is relatively easy to craft, Lau predicted attacks will start until it is fixed.

In their research paper, Di Paola and Fedon wrote that the type of attack used to exploit the problem is called universal cross-site scripting, which uses a flaw in the browser rather than a vulnerability within a Web site. A cross-site scripting attack involves the unintended execution of code as part of a query string contained within a URL (uniform resource locator).

Another Symantec blogger, Zulfikar Ramzan, wrote that attackers can exploit a cross-scripting vulnerability by creating a special URL that points to the Web page. In that URL, the attacker would code it to include some of his own content -- such as a form soliciting passwords or credit-card information -- that would be displayed on the targeted Web page.

When victims click on the URL -- which, for example, could be included in a link enclosed in e-mail -- they would be directed to the Web page. If they fill out information on a form on the page, it could be passed to the attacker without the victim knowing the site had been tampered with, Ramzan wrote.

"The result is that the user is lulled into a false sense of security since he trusts the site and therefore trusts any transaction he has with it, even though in reality he is transacting with an attacker," Ramzan wrote.

An Adobe spokesman contacted in London on Wednesday afternoon could not immediately comment.

In highlighting the problem with the Reader plugin, the researchers Di Paola and Fedon warned that Web 2.0 applications -- such as Google's Gmail and Google Maps, both of which employ AJAX -- will need to be more tightly tied to the security of Web browsers.

Otherwise, the plethora of features in those applications "can be turned into weapons if controlled by a malicious hacker," they wrote.

Join the newsletter!

Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection
Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Jeremy Kirk

IDG News Service
Show Comments

Cool Tech

SanDisk MicroSDXC™ for Nintendo® Switch™

Learn more >

Breitling Superocean Heritage Chronographe 44

Learn more >

Toys for Boys

Family Friendly

Panasonic 4K UHD Blu-Ray Player and Full HD Recorder with Netflix - UBT1GL-K

Learn more >

Stocking Stuffer

Razer DeathAdder Expert Ergonomic Gaming Mouse

Learn more >

Christmas Gift Guide

Click for more ›

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Edwina Hargreaves

WD My Cloud Home

I would recommend this device for families and small businesses who want one safe place to store all their important digital content and a way to easily share it with friends, family, business partners, or customers.

Walid Mikhael

Brother QL-820NWB Professional Label Printer

It’s easy to set up, it’s compact and quiet when printing and to top if off, the print quality is excellent. This is hands down the best printer I’ve used for printing labels.

Ben Ramsden

Sharp PN-40TC1 Huddle Board

Brainstorming, innovation, problem solving, and negotiation have all become much more productive and valuable if people can easily collaborate in real time with minimal friction.

Sarah Ieroianni

Brother QL-820NWB Professional Label Printer

The print quality also does not disappoint, it’s clear, bold, doesn’t smudge and the text is perfectly sized.

Ratchada Dunn

Sharp PN-40TC1 Huddle Board

The Huddle Board’s built in program; Sharp Touch Viewing software allows us to easily manipulate and edit our documents (jpegs and PDFs) all at the same time on the dashboard.

George Khoury

Sharp PN-40TC1 Huddle Board

The biggest perks for me would be that it comes with easy to use and comprehensive programs that make the collaboration process a whole lot more intuitive and organic

Featured Content

Product Launch Showcase

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?